Jump-start your project by learning from devs who
write Windows drivers and file systems every day.
Take an OSR seminar!

Upcoming OSR Seminars:
WDM Lab, Seattle, WA 16 August 2010
WDF Lab, Santa Clara, CA 27 September 2010
Debug Lab, Portland, OR 18 October 2010
Windows Internals & Software Drivers Lab, Santa Clara, CA 15 November 2010


Go Back   OSR Online Lists > ntdev
link Get BSOD information
Welcome, Guest
You must login to post to this list
  Message 1 of 10  
18 Sep 06 01:24
Ray
xxxxxx@ybwork.com
Join Date: 31 Oct 2002
Posts To This List: 99
Get BSOD information
Hi, Is there any win32 or kernel API to get BSOD information such as driver's name? The scenario is that I want to disable the buggy driver at next Windows starts when there is a BSOD. Any ideas are welcome. Regards, R.Y.
  Message 2 of 10  
18 Sep 06 10:45
ntdev member 5742
xxxxxx@positivenetworks.net
Join Date:
Posts To This List: 351
Re: Get BSOD information
On Sep 18, 2006, at 12:24 AM, xxxxx@ybwork.com wrote: > Is there any win32 or kernel API to get BSOD information such as > driver's name? > > The scenario is that I want to disable the buggy driver at next > Windows starts when there is a BSOD. Offhand, I'd say this project probably won't work as well as you envision. Many of my best bugs :-) wind up crashing out in other drivers. You'd wind up with tons of false positives and false negatives. Besides, you can't just auto-disable many drivers without breaking something. Can you tell us a bit more about the project? -sd
  Message 3 of 10  
18 Sep 06 12:28
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 5070
Re: Get BSOD information
xxxxx@ybwork.com wrote: >Hi, > >Is there any win32 or kernel API to get BSOD information such as driver's name? > >The scenario is that I want to disable the buggy driver at next Windows starts when there is a BSOD. > >Any ideas are welcome. > > And what if the BSOD comes from ntoskrnl.exe? Are you going to disable that? It will render your customers rather unhappy. There is absolutely no way to automatically do what you have described. There are way too many ways for a buggy driver to step on non-paged pool, thereby causing a crash much later in a competely unrelated driver. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 4 of 10  
18 Sep 06 20:18
Ray
xxxxxx@ybwork.com
Join Date: 31 Oct 2002
Posts To This List: 99
RE: Get BSOD information
The scenario is we have 5 drivers and want to disable some of them when users find there is a BSOD occurs in them. So, we do not want to disable other drivers which are from MS or 3rd parties. In case of the faulty driver is not specified for a BSOD, this 'disable' just ignores it. That's what I want.
  Message 5 of 10  
18 Sep 06 20:42
Mark Roddy
xxxxxx@hollistech.com
Join Date: 25 Feb 2000
Posts To This List: 2663
RE: Get BSOD information
You mean you want to do this automatically through some analysis of a crashdump after one of your customer's system crashes and reboots? Do I have to state the obvious here? (Rhetorical question.) You should consider not shipping drivers that crash your customer's systems. Yes it is possible to analyze crash dumps and programmatically take a guess, sometimes a real good guess, at the guilty party. Microsoft gives interesting talks every WinHec on their Online Crash Analysis system and its gigunda database that is starting to get pretty good at pointing a reasonably accurate finger at guilty parties. See the winhec slides. ===================== Mark Roddy DDK MVP Windows 2003/XP/2000 Consulting Hollis Technology Solutions 603-321-1032 www.hollistech.com > -----Original Message----- > From: xxxxx@lists.osr.com > [mailto:xxxxx@lists.osr.com] On Behalf Of > xxxxx@ybwork.com > Sent: Monday, September 18, 2006 8:18 PM > To: Windows System Software Devs Interest List > Subject: RE:[ntdev] Get BSOD information > > The scenario is we have 5 drivers and want to disable some of > them when users find there is a BSOD occurs in them. So, we <...excess quoted lines suppressed...>
  Message 6 of 10  
18 Sep 06 21:15
Ray
xxxxxx@ybwork.com
Join Date: 31 Oct 2002
Posts To This List: 99
RE: Get BSOD information
Yes, that's what I mean. I also agree with you that it's bad to ship buggy drivers. However, my user-mode developers/managers still want this solution for temp use. Sounds bad, ha? In fact, I think what they need is a bit similar to the popup dialog at the logon time of Windows 2003 Server which shows an error message of BSOD happened in last session. Does MS provide any APIs related to it? It does not look like a crash dump analysis. Anyway, I'll have a look at Online Crash Analysis. Thanks Mark.
  Message 7 of 10  
19 Sep 06 12:40
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 5070
Re: Get BSOD information
xxxxx@ybwork.com wrote: >Yes, that's what I mean. I also agree with you that it's bad to ship buggy drivers. However, my user-mode developers/managers still want this solution for temp use. Sounds bad, ha? > >In fact, I think what they need is a bit similar to the popup dialog at the logon time of Windows 2003 Server which shows an error message of BSOD happened in last session. Does MS provide any APIs related to it? It does not look like a crash dump analysis. > > I can think of a couple of simple ways to provide this kind of thing. I presume you want to go on the assumption that, if a crash occurred, it was your driver that caused it, right? You can have your driver write a value to the registry when it was loaded, then delete it or write a different value when it unloads normally. When the driver comes up, if the registry value has the wrong state, then an unclean shutdown occurred. You can say "It appears that something went FUBAR. Shall I disable Ray's driver?" -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 8 of 10  
19 Sep 06 13:40
ntdev member 2092
xxxxxx@stratus.com
Join Date:
Posts To This List: 1798
RE: Get BSOD information
The OP's stated problem is a bit more complicated. "The scenario is we have 5 drivers and want to disable some of them when users find there is a BSOD occurs in them". The OP seems to want to figure out which of his five drivers, if any, was the cause of the BSOD, and then only disable the bad driver. I think that requires some form of crash analysis. -----Original Message----- From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Tim Roberts Sent: Tuesday, September 19, 2006 12:39 PM To: Windows System Software Devs Interest List Subject: Re: [ntdev] Get BSOD information xxxxx@ybwork.com wrote: >Yes, that's what I mean. I also agree with you that it's bad to ship buggy drivers. However, my user-mode developers/managers still want this solution for temp use. Sounds bad, ha? > >In fact, I think what they need is a bit similar to the popup dialog at the logon time of Windows 2003 Server which shows an error message of BSOD happened in last session. Does MS provide any APIs related to it? It does not look like a crash dump analysis. > > I can think of a couple of simple ways to provide this kind of thing. I presume you want to go on the assumption that, if a crash occurred, it was your driver that caused it, right? You can have your driver write a value to the registry when it was loaded, then delete it or write a different value when it unloads normally. When the driver comes up, if the registry value has the wrong state, then an unclean shutdown occurred. You can say "It appears that something went FUBAR. Shall I disable Ray's driver?" -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc. --- Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
  Message 9 of 10  
19 Sep 06 14:21
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 5070
Re: Get BSOD information
Roddy, Mark wrote: >The OP's stated problem is a bit more complicated. > >"The scenario is we have 5 drivers and want to disable some of them when >users find there is a BSOD occurs in them". > > Whoops, I completely missed that. Either that, or I blocked it out in my rush to point out a solution. >The OP seems to want to figure out which of his five drivers, if any, >was the cause of the BSOD, and then only disable the bad driver. I think >that requires some form of crash analysis. > > Yes, I agree, and it's not going to be easy. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 10 of 10  
19 Sep 06 20:11
Ray
xxxxxx@ybwork.com
Join Date: 31 Oct 2002
Posts To This List: 99
RE: Get BSOD information
<quote> I can think of a couple of simple ways to provide this kind of thing. I presume you want to go on the assumption that, if a crash occurred, it was your driver that caused it, right? You can have your driver write a value to the registry when it was loaded, then delete it or write a different value when it unloads normally. When the driver comes up, if the registry value has the wrong state, then an unclean shutdown occurred. You can say "It appears that something went FUBAR. Shall I disable Ray's driver?" </quote> Yep. We are considering about this solution as well. <quote> The OP's stated problem is a bit more complicated. "The scenario is we have 5 drivers and want to disable some of them when users find there is a BSOD occurs in them". The OP seems to want to figure out which of his five drivers, if any, was the cause of the BSOD, and then only disable the bad driver. I think that requires some form of crash analysis. </quote> Yep. It's better to get the name of faulty driver. Anyway, thanks to all you guys replies. Cheers, R.Y.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 13:52.

Contact Us - Osr Online Homepage - Top

Copyright ©2005, OSR Open Systems Resourcs, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license